CVE-2023-54069

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-54069
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54069.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-54069
Downstream
BELL (1)
DEBIAN (1)
RHSA (1)
SUSE (8)
UBUNTU (1)
Related
SUSE (8)
Published
2025-12-24T12:23:13Z
Modified
2026-10-08T02:48:03Z
Summary
ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
Details

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow

When we calculate the end position of ext4_free_extent, this position may be exactly where ext4_lblk_t (i.e. uint) overflows. For example, if ac_g_ex.fe_logical is 4294965248 and ac_orig_goal_len is 2048, then the computed end is 0x100000000, which is 0. If ac->ac_o_ex.fe_logical is not the first case of adjusting the best extent, that is, new_bex_end > 0, the following BUG_ON will be triggered:

========================================================= kernel BUG at fs/ext4/mballoc.c:5116! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 3 PID: 673 Comm: xfs_io Tainted: G E 6.5.0-rc1+ #279 RIP: 0010:ext4_mb_new_inode_pa+0xc5/0x430 Call Trace: ext4_mb_use_best_found+0x203/0x2f0 ext4_mb_try_best_found+0x163/0x240 ext4_mb_regular_allocator+0x158/0x1550 ext4_mb_new_blocks+0x86a/0xe10 ext4_ext_map_blocks+0xb0c/0x13a0 ext4_map_blocks+0x2cd/0x8f0 ext4_iomap_begin+0x27b/0x400 iomap_iter+0x222/0x3d0 __iomap_dio_rw+0x243/0xcb0 iomap_dio_rw+0x16/0x80

A simple reproducer demonstrating the problem:

mkfs.ext4 -F /dev/sda -b 4096 100M
mount /dev/sda /tmp/test
fallocate -l1M /tmp/test/tmp
fallocate -l10M /tmp/test/file
fallocate -i -o 1M -l16777203M /tmp/test/file
fsstress -d /tmp/test -l 0 -n 100000 -p 8 &
sleep 10 && killall -9 fsstress
rm -f /tmp/test/tmp
xfs_io -c "open -ad /tmp/test/file" -c "pwrite -S 0xff 0 8192"

We simply refactor the logic for adjusting the best extent by adding a temporary ext4_free_extent ex and use extent_logical_end() to avoid overflow, which also simplifies the code.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54069.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
8659c5f4ffaacbe932849b98462c3d635b4eacea
Fixed
83ecffd40c65844a73c2e93d7c841455786605ac
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fc7237e191b99f88e859316fab2b06c2c26c8344
Fixed
58fe961c606c446f5612f6897827b1cac42c2e89
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
613f6cde5ebb005a37fda117cdda7b4126170c13
Fixed
f2c3a3aa6f11ad9878dbc3a067b0633e07b586c1
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9d4430b7f862ce8835ca4e054b6916d15c8e0862
Fixed
fcefddf3a151b2c416b20120c06bb1ba9ad676fb
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
93cdf49f6eca5e23f6546b8f28457b2e6a6961d9
Fixed
b7e9ec38b6a0beb5a49cd1e76be0a9a07c218e90
Fixed
bc056e7163ac7db945366de219745cf94f32a3e6
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.4.244
Fixed
5.4.260
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.10.181
Fixed
5.10.200
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.15.113
Fixed
5.15.138
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.1.30
Fixed
6.1.61
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.14.316
Fixed
4.15
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.19.284
Fixed
4.20
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.3.4
Fixed
6.4
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
46772ab99409cc72241227dd8f5295f358233fda
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
25a60b4533268477920faaeebd99e7e69c0735cd
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cec4ef62b36b04e0bc8905732adab091f4bc1cfd

Affected versions

v4.*
v4.14.316
v4.14.317
v4.14.318
v4.14.319
v4.14.320
v4.14.321
v4.14.322
v4.14.323
v4.14.324
v4.14.325
v4.14.326
v4.14.327
v4.14.328
v4.14.329
v4.14.330
v4.14.331
v4.14.332
v4.14.333
v4.14.334
v4.14.335
v4.14.336
v4.19.284
v4.19.285
v4.19.286
v4.19.287
v4.19.288
v4.19.289
v4.19.290
v4.19.291
v4.19.292
v4.19.293
v4.19.294
v4.19.295
v4.19.296
v4.19.297
v4.19.298
v4.19.299
v4.19.300
v4.19.301
v4.19.302
v4.19.303
v4.19.304
v4.19.305
v4.19.306
v4.19.307
v4.19.308
v4.19.309
v4.19.310
v4.19.311
v4.19.312
v4.19.313
v4.19.314
v4.19.315
v4.19.316
v4.19.317
v4.19.318
v4.19.319
v4.19.320
v4.19.321
v4.19.322
v4.19.323
v4.19.324
v4.19.325
v5.*
v5.10.181
v5.10.182
v5.10.183
v5.10.184
v5.10.185
v5.10.186
v5.10.187
v5.10.188
v5.10.189
v5.10.190
v5.10.191
v5.10.192
v5.10.193
v5.10.194
v5.10.195
v5.10.196
v5.10.197
v5.10.198
v5.10.199
v5.15.113
v5.15.114
v5.15.115
v5.15.116
v5.15.117
v5.15.118
v5.15.119
v5.15.120
v5.15.121
v5.15.122
v5.15.123
v5.15.124
v5.15.125
v5.15.126
v5.15.127
v5.15.128
v5.15.129
v5.15.130
v5.15.131
v5.15.132
v5.15.133
v5.15.134
v5.15.135
v5.15.136
v5.15.137
v5.4.244
v5.4.245
v5.4.246
v5.4.247
v5.4.248
v5.4.249
v5.4.250
v5.4.251
v5.4.252
v5.4.253
v5.4.254
v5.4.255
v5.4.256
v5.4.257
v5.4.258
v5.4.259
v6.*
v6.1.30
v6.1.31
v6.1.32
v6.1.33
v6.1.34
v6.1.35
v6.1.36
v6.1.37
v6.1.38
v6.1.39
v6.1.40
v6.1.41
v6.1.42
v6.1.43
v6.1.44
v6.1.45
v6.1.46
v6.1.47
v6.1.48
v6.1.49
v6.1.50
v6.1.51
v6.1.52
v6.1.53
v6.1.54
v6.1.55
v6.1.56
v6.1.57
v6.1.58
v6.1.59
v6.1.60
v6.3.10
v6.3.11
v6.3.12
v6.3.13
v6.3.4
v6.3.5
v6.3.6
v6.3.7
v6.3.8
v6.3.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54069.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.4.260
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.200
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.138
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.61
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.5.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54069.json"